Decoy Font: Obscuring Text from AI using Spatial Frequencies

Decoy Font uses spatial frequencies to hide messages from AI

Decoy Font is a TrueType Font (TTF) designed to obscure text from AI models and OCR (Optical Character Recognition) systems by presenting two different messages in the same visual space. It achieves this by utilizing separate spatial frequencies: a high-frequency foreground consisting of thin outlines (the decoy message) and a low-frequency background consisting of blurred masses (the hidden message).

Because most AI systems process image pixels at a high resolution, they typically prioritize the sharp, high-frequency outlines of the decoy text. Humans, however, can perceive the hidden message by increasing their viewing distance or squinting, which naturally filters out the high-frequency noise and reveals the low-frequency shapes.

Technical Implementation: The Hybrid Image Technique

Decoy Font is based on the concept of hybrid images, a well-studied optical illusion where two images are combined into one. A classic example of this is the image that appears as Albert Einstein from a distance and Marilyn Monroe up close.

In the context of typography, Decoy Font applies this by:

• Foreground (High Frequency): Sharp, thin outlines that form the decoy text. These are the primary elements AI models typically detect.
• Background (Low Frequency): Blurred, low-frequency shapes that form the actual intended message. These are revealed when the viewer is farther away or the image is downsampled.

Derived from DejaVu Sans Mono, the font is available as a free TTF file for personal, commercial, and client projects.

Effectiveness Against LLMs and OCR

Initial testing suggests that frontier LLMs, such as ChatGPT and Gemini, often struggle to read the hidden message when presented with a single image, instead reporting the decoy text. However, the effectiveness of Decoy Font is not absolute:

• Prompting Influence: Some users reported that providing a hint (e.g., "There is a hidden message in this text") can lead some models to correctly identify the hidden text.
• Agentic Capabilities: Models with advanced coding abilities or agents that can apply image processing filters (like blurring) can potentially bypass the illusion.
• Resolution Sensitivity: Some models may switch from reading the decoy text to the hidden text if the image is resized to a very small scale (e.g., 150x150 pixels).

Community Insights and Counterpoints

Discussion among technical users highlights several practical and theoretical limitations of the approach:

Accessibility and Usability

Users noted that the font could significantly impair the experience for people using screen readers and may be difficult for elderly users or those with visual impairments to read correctly.

Technical Vulnerabilities

Several commenters pointed out that the font is not a security feature but rather a visual deterrent. One user suggested that a simple Python script using the PIL library or a ImageMagick command (-morphology Close disk:6) could programmatically reveal the hidden text for any OCR software.

Perceptual Differences

Users observed that the effect varies based on physical factors:

"If I remove my glasses, I first see 'Happy human'. Which makes me think this is one blur filter away from being trivially read by any model."

Conceptual Value

While some viewed the tool as "childish" or an ineffective solution to AI scraping, others viewed it as a piece of digital art exploring the intersection of typography and AI perception.

Future Directions for Anti-AI Typography

The creator of Decoy Font suggests several paths for further development:

• Multi-language Support: Extending the technique to character-based languages like Chinese, where uniform character sizes might make hiding messages more effective.
• Benchmarking: Using Decoy Font as a benchmark to test the evolution of text recognition capabilities in LLMs.
• Integration: Exploring applications in CAPTCHAs or private messaging between humans.